Typical computer systems include a file system to control how data is stored and retrieved. Conventional file systems maintain information regarding user access permission in conjunction with each stored resource to control users' ability to access the resources. For example, one user may be permitted to view and change a particular resource while another user may only be permitted to view the resource. In some instances, multiple application programs may share common access to resources included in a single file system. For example, a suite of network applications may provide a common interface that provides a user with various related functionalities that allow the user to interact with a common repository of data objects shared by the application suite. In these instances, each application program is typically responsible for evaluating whether a user has permission to access a resource included in the file system based on the user access permission information maintained along with the resource. Not only does this conventional implementation lead to painstaking redundancies in development of such an application, but this also presents the potential for inconsistent handling of user access permissions across each of the applications.
An additional downfall of conventional file systems is in the handling of resources with dependencies to other resources. Because the permission information of each resource is maintained along with the resource itself, in order to determine whether a user may access a resource with dependencies, the evaluator must traverse the entire tree of dependencies of the resource to reach the correct determination. As a result of this read-heavy workflow, computational resources are inefficiently used because of the number of statements that must be executed to determine the actual access permission of the user, which, in turn, leads to a degradation to system performance.